Claude Code and Gemini CLI Flaws Let a GitHub Issue Reach CI Workflow Secrets

Security researchers at Novee Security have uncovered critical vulnerabilities in AI coding agents from Anthropic, Google, and OpenAI. The flaws allow an unprivileged attacker to execute code on CI runners or hijack agent operations, simply by opening a GitHub issue. The findings were presented at Black Hat USA on August 5, 2026.

The most severe issue is CVE-2026-12537, a CVSS 10.0 OS command injection in Google’s Gemini CLI. It is triggered via a crafted .gemini/.env file, allowing code execution on the host before the sandbox starts. The flaw is fixed in Gemini CLI 0.39.1 and run-gemini-cli 0.1.22.

Anthropic’s Claude Code is affected by CVE-2026-54316, which uses Hugging Face’s public download counter as an exfiltration channel to leak API keys one character at a time. The issue is fixed in Claude Code 2.1.163, but all versions from 0.2.54 to 2.1.163 are vulnerable. Anthropic rates it Moderate (CVSS 6.0), while NVD assigns a 9.1 CVSS v3.1 score.

For OpenAI’s Codex, no CVE was issued. Novee found that the openai/codex repository ran two Codex passes in a single job, allowing the first pass to write an AGENTS.md file that the second pass would load as instructions. OpenAI has since separated the passes into different jobs and updated documentation to treat repository instruction files as untrusted input.

Novee emphasizes that the root cause lies in the harness—the code between the model and the real world—where one part marks a value safe and a later part acts on it with more authority. The researchers recommend updating all affected tools and auditing any workflow that can be triggered by external users.

Neither CVE appears in CISA’s Known Exploited Vulnerabilities catalog, and no active exploitation has been observed. However, a public GitHub repository claiming to be a reproduction lab for the Claude Code flaw has been available since June 18.